`compose.one` (and likely other read endpoints) return env vars in plaintext, leaking secrets into LLM context

[milkyskies]

The compose-one MCP tool returns the full env field as a plaintext string in its response payload, including any secrets stored there (API keys, admin passwords, DB credentials, registration tokens, etc.).

Example response shape:

{
  "data": {
    "composeId": "...",
    "env": "POSTGRES_PASSWORD=hunter2\nADMIN_PASSWORD=...\nOPENAI_API_KEY=sk-...",
    "composeFile": "...",
    ...
  }
}

[vinicius507]

Can't believe this is a thing. Just went through this myself.

I just added the mcp to my config and now I'm removing it.

Hoping this gets fixed.

EDIT: #38 adds an opt-in config for secret redacting. Why such an important feature is opt-in though? Who knows

[codebeetl]

Set environment variable DOKPLOY_REDACT_ENV=true - incredibly env redaction defaults to false! (see README.md for confirmation).

But note that DEFAULT_REDACTED_FIELDS has no entry for content - only specific names like env, password, token, sshKey, etc. So if compose.one's response embeds a service's mounts (e.g. detail-view endpoints typically do, to let the UI render the full config in one call), any secret sitting in mounts[].content sails straight through regardless of DOKPLOY_REDACT_ENV.

The flag being true only means the walk happens; it still doesn't know content is sensitive.

[codebeetl]

Opened #66 for an additional gap this issue surfaces: even with DOKPLOY_REDACT_ENV=true (from #38), redactSensitive() only matched field names by exact equality, so provider-prefixed secret fields (githubClientSecret, githubPrivateKey, githubWebhookSecret, etc.) returned by compose.one were never caught and leaked in plaintext. #66 fixes the matching logic (equals-or-ends-with) without changing the DOKPLOY_REDACT_ENV default, so the "off by default" concern in the original report is still open.

[Siumauricio]

Resolved via opt-in response redaction: set DOKPLOY_REDACT_ENV=true and the server redacts secret-bearing fields (env, environment, composeFile, dockerCompose, buildArgs, passwords, tokens, keys, etc.) from API responses before they reach the MCP client — so compose.one and other read endpoints no longer leak env vars into LLM context. The field list is customizable with DOKPLOY_REDACT_FIELDS; both are documented in the README.

Note: one known gap remains for provider-prefixed secret field names, tracked separately in #65. Closing this one; reopen if a field you care about isn't covered by the defaults + custom list.